diff --git a/.goss.yaml b/.goss.yaml index ef4bbe8d..292c1a66 100644 --- a/.goss.yaml +++ b/.goss.yaml @@ -16,22 +16,22 @@ file: /var/ossec/etc/lists/audit-keys: exists: true mode: "0660" - owner: ossec - group: ossec + owner: wazuh + group: wazuh filetype: file contains: [] /var/ossec/etc/ossec.conf: exists: true mode: "0660" owner: root - group: ossec + group: wazuh filetype: file contains: [] /var/ossec/etc/rules/local_rules.xml: exists: true mode: "0660" - owner: ossec - group: ossec + owner: wazuh + group: wazuh filetype: file contains: [] /var/ossec/etc/sslmanager.cert: @@ -56,7 +56,7 @@ package: wazuh-manager: installed: true versions: - - 4.2.5 + - 4.3.0 port: tcp:1514: listening: true @@ -71,26 +71,26 @@ port: ip: - 0.0.0.0 user: - ossec: + wazuh: exists: true groups: - - ossec + - wazuh home: /var/ossec shell: /sbin/nologin - ossecm: + wazuh: exists: true groups: - - ossec + - wazuh home: /var/ossec shell: /sbin/nologin - ossecr: + wazuh: exists: true groups: - - ossec + - wazuh home: /var/ossec shell: /sbin/nologin group: - ossec: + wazuh: exists: true process: filebeat: diff --git a/CHANGELOG.md b/CHANGELOG.md index ea4fbf60..6e6992ca 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,11 @@ # Change Log All notable changes to this project will be documented in this file. +## Wazuh Docker v4.3.0 +### Added + +- Update Wazuh to version [4.3.0](https://github.com/wazuh/wazuh/blob/v4.3.0/CHANGELOG.md#v430) + ## Wazuh Docker v4.2.5 ### Added @@ -11,7 +16,6 @@ All notable changes to this project will be documented in this file. - Update Wazuh to version [4.2.4](https://github.com/wazuh/wazuh/blob/v4.2.4/CHANGELOG.md#v424) - ## Wazuh Docker v4.2.3 ### Added diff --git a/README.md b/README.md index e49e3a28..a411ec5b 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,7 @@ In addition, a docker-compose file is provided to launch the containers mentione Before starting the environment it is required to provide an SSL certificate (or just generate one self-signed). -Documentation on how to provide these two can be found at [Wazuh Docer Documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#production-deployment). +Documentation on how to provide these two can be found at [Wazuh Docker Documentation](https://documentation.wazuh.com/current/docker/wazuh-container.html#production-deployment). ## Environment Variables @@ -149,11 +149,11 @@ ADMIN_PRIVILEGES=true # App privileges * `master` branch contains the latest code, be aware of possible bugs on this branch. * `stable` branch on correspond to the last Wazuh stable version. - ## Compatibility Matrix | Wazuh version | ODFE | XPACK | |---------------|---------|--------| +| v4.3.0 | 1.13.2 | 7.11.2 | | v4.2.5 | 1.13.2 | 7.11.2 | | v4.2.4 | 1.13.2 | 7.11.2 | | v4.2.3 | 1.13.2 | 7.11.2 | diff --git a/VERSION b/VERSION index e911e8a7..5fedc35e 100644 --- a/VERSION +++ b/VERSION @@ -1,2 +1,2 @@ -WAZUH-DOCKER_VERSION="4.2.5" -REVISION="40220" +WAZUH-DOCKER_VERSION="4.3.0" +REVISION="43100" diff --git a/docker-compose.yml b/docker-compose.yml index a17edcac..2b12af30 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh: - image: wazuh/wazuh-odfe:4.2.5 + image: wazuh/wazuh-odfe:4.3.0 hostname: wazuh-manager restart: always ports: @@ -50,7 +50,7 @@ services: hard: 65536 kibana: - image: wazuh/wazuh-kibana-odfe:4.2.5 + image: wazuh/wazuh-kibana-odfe:4.3.0 hostname: kibana restart: always ports: diff --git a/kibana-odfe/Dockerfile b/kibana-odfe/Dockerfile index 3cad99ba..1d304341 100644 --- a/kibana-odfe/Dockerfile +++ b/kibana-odfe/Dockerfile @@ -2,7 +2,7 @@ FROM amazon/opendistro-for-elasticsearch-kibana:1.13.2 USER kibana ARG ELASTIC_VERSION=7.10.2 -ARG WAZUH_VERSION=4.2.5 +ARG WAZUH_VERSION=4.3.0 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" WORKDIR /usr/share/kibana diff --git a/kibana/Dockerfile b/kibana/Dockerfile index 370e6f9b..d98443ae 100644 --- a/kibana/Dockerfile +++ b/kibana/Dockerfile @@ -2,7 +2,7 @@ FROM docker.elastic.co/kibana/kibana:7.10.2 USER kibana ARG ELASTIC_VERSION=7.10.2 -ARG WAZUH_VERSION=4.2.5 +ARG WAZUH_VERSION=4.3.0 ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" WORKDIR /usr/share/kibana diff --git a/production-cluster.yml b/production-cluster.yml index d10ad3c6..df0d2250 100644 --- a/production-cluster.yml +++ b/production-cluster.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh-master: - image: wazuh/wazuh-odfe:4.2.5 + image: wazuh/wazuh-odfe:4.3.0 hostname: wazuh-master restart: always ports: @@ -38,7 +38,7 @@ services: - ./production_cluster/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf wazuh-worker: - image: wazuh/wazuh-odfe:4.2.5 + image: wazuh/wazuh-odfe:4.3.0 hostname: wazuh-worker restart: always environment: @@ -134,7 +134,7 @@ services: - ./production_cluster/elastic_opendistro/internal_users.yml:/usr/share/elasticsearch/plugins/opendistro_security/securityconfig/internal_users.yml kibana: - image: wazuh/wazuh-kibana-odfe:4.2.5 + image: wazuh/wazuh-kibana-odfe:4.3.0 hostname: kibana restart: always ports: diff --git a/production_cluster/wazuh_cluster/wazuh_manager.conf b/production_cluster/wazuh_cluster/wazuh_manager.conf index 822bca19..38a180d6 100644 --- a/production_cluster/wazuh_cluster/wazuh_manager.conf +++ b/production_cluster/wazuh_cluster/wazuh_manager.conf @@ -6,7 +6,7 @@ no no smtp.example.wazuh.com - ossecm@example.wazuh.com + wazuh@example.wazuh.com recipient@example.wazuh.com 12 alerts.log @@ -200,8 +200,8 @@ 127.0.0.1 ^localhost.localdomain$ - 4.2.5.1 - 4.2.5.2 + 4.3.0.1 + 4.3.0.2 208.67.220.220 diff --git a/production_cluster/wazuh_cluster/wazuh_worker.conf b/production_cluster/wazuh_cluster/wazuh_worker.conf index d409dab5..bc0bbb8d 100644 --- a/production_cluster/wazuh_cluster/wazuh_worker.conf +++ b/production_cluster/wazuh_cluster/wazuh_worker.conf @@ -6,7 +6,7 @@ no no smtp.example.wazuh.com - ossecm@example.wazuh.com + wazuh@example.wazuh.com recipient@example.wazuh.com 12 alerts.log @@ -200,8 +200,8 @@ 127.0.0.1 ^localhost.localdomain$ - 4.2.5.1 - 4.2.5.2 + 4.3.0.1 + 4.3.0.2 208.67.220.220 diff --git a/wazuh-odfe/Dockerfile b/wazuh-odfe/Dockerfile index ec356ccb..73cb6034 100644 --- a/wazuh-odfe/Dockerfile +++ b/wazuh-odfe/Dockerfile @@ -3,7 +3,7 @@ FROM centos:7 ARG FILEBEAT_CHANNEL=filebeat-oss ARG FILEBEAT_VERSION=7.10.2 -ARG WAZUH_VERSION=4.2.5 +ARG WAZUH_VERSION=4.3.0-1 ARG TEMPLATE_VERSION="master" ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz" @@ -40,7 +40,7 @@ ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/e RUN chmod go-w /etc/filebeat/wazuh-template.json COPY config/etc/ /etc/ -COPY --chown=root:ossec config/create_user.py /var/ossec/framework/scripts/create_user.py +COPY --chown=root:wazuh config/create_user.py /var/ossec/framework/scripts/create_user.py # Prepare permanent data # Sync calls are due to https://github.com/docker/docker/issues/9547 diff --git a/wazuh-odfe/config/etc/cont-init.d/2-manager b/wazuh-odfe/config/etc/cont-init.d/2-manager index 58807682..9e70ace9 100644 --- a/wazuh-odfe/config/etc/cont-init.d/2-manager +++ b/wazuh-odfe/config/etc/cont-init.d/2-manager @@ -36,11 +36,11 @@ function_wazuh_migration(){ fi \cp -f /wazuh-migration/data/etc/ossec.conf /var/ossec/etc/ossec.conf - chown root:ossec /var/ossec/etc/ossec.conf + chown root:wazuh /var/ossec/etc/ossec.conf chmod 640 /var/ossec/etc/ossec.conf \cp -f /wazuh-migration/data/etc/client.keys /var/ossec/etc/client.keys - chown ossec:ossec /var/ossec/etc/client.keys + chown wazuh:wazuh /var/ossec/etc/client.keys chmod 640 /var/ossec/etc/client.keys \cp -f /wazuh-migration/data/etc/sslmanager.cert /var/ossec/etc/sslmanager.cert @@ -49,25 +49,25 @@ function_wazuh_migration(){ chmod 640 /var/ossec/etc/sslmanager.cert /var/ossec/etc/sslmanager.key \cp -f /wazuh-migration/data/etc/shared/default/agent.conf /var/ossec/etc/shared/default/agent.conf - chown ossec:ossec /var/ossec/etc/shared/default/agent.conf + chown wazuh:wazuh /var/ossec/etc/shared/default/agent.conf chmod 660 /var/ossec/etc/shared/default/agent.conf \cp -f /wazuh-migration/data/etc/decoders/* /var/ossec/etc/decoders/ - chown ossec:ossec /var/ossec/etc/decoders/* + chown wazuh:wazuh /var/ossec/etc/decoders/* chmod 660 /var/ossec/etc/decoders/* \cp -f /wazuh-migration/data/etc/rules/* /var/ossec/etc/rules/ - chown ossec:ossec /var/ossec/etc/rules/* + chown wazuh:wazuh /var/ossec/etc/rules/* chmod 660 /var/ossec/etc/rules/* if [ -e /wazuh-migration/data/agentless/.passlist ]; then \cp -f /wazuh-migration/data/agentless/.passlist /var/ossec/agentless/.passlist - chown root:ossec /var/ossec/agentless/.passlist + chown root:wazuh /var/ossec/agentless/.passlist chmod 640 /var/ossec/agentless/.passlist fi \cp -f /wazuh-migration/global.db /var/ossec/queue/db/global.db - chown ossec:ossec /var/ossec/queue/db/global.db + chown wazuh:wazuh /var/ossec/queue/db/global.db chmod 640 /var/ossec/queue/db/global.db # mark volume as migrated diff --git a/wazuh-odfe/config/etc/services.d/ossec-logs/run b/wazuh-odfe/config/etc/services.d/ossec-logs/run index edb4b87c..e96cba8f 100644 --- a/wazuh-odfe/config/etc/services.d/ossec-logs/run +++ b/wazuh-odfe/config/etc/services.d/ossec-logs/run @@ -1,4 +1,4 @@ #!/usr/bin/with-contenv sh # dumping ossec.log to standard output -exec tail -f /var/ossec/logs/ossec.log +exec tail -F /var/ossec/logs/ossec.log diff --git a/wazuh-odfe/config/permanent_data.env b/wazuh-odfe/config/permanent_data.env index 36d35a2a..34f646c3 100644 --- a/wazuh-odfe/config/permanent_data.env +++ b/wazuh-odfe/config/permanent_data.env @@ -48,6 +48,7 @@ PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_generic_diff" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_foundry_diff" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_nopass.exp" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp" +PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/utils.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py" PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs" diff --git a/xpack-compose.yml b/xpack-compose.yml index bc13e81e..f741a7ce 100644 --- a/xpack-compose.yml +++ b/xpack-compose.yml @@ -3,7 +3,7 @@ version: '3.7' services: wazuh: - image: wazuh/wazuh:4.2.5 + image: wazuh/wazuh:4.3.0 hostname: wazuh-manager restart: always ports: @@ -146,7 +146,7 @@ services: kibana: - image: wazuh/wazuh-kibana:4.2.5 + image: wazuh/wazuh-kibana:4.3.0 hostname: kibana restart: always ports: diff --git a/xpack-from-sources.yml b/xpack-from-sources.yml index 1691707e..922eee93 100644 --- a/xpack-from-sources.yml +++ b/xpack-from-sources.yml @@ -8,7 +8,7 @@ services: args: - FILEBEAT_CHANNEL=filebeat - FILEBEAT_VERSION=7.11.2 - image: wazuh/wazuh:4.2.5 + image: wazuh/wazuh:4.3.0 hostname: wazuh-manager restart: always ports: @@ -152,7 +152,7 @@ services: kibana: build: kibana/ - image: wazuh/wazuh-kibana:4.2.5 + image: wazuh/wazuh-kibana:4.3.0 hostname: kibana restart: always ports: